Voting with Risk-Limiting Audits: Better, Faster, Cheaper

Election audits ought to be like an annual checkup, not a visit to the emergency room

After extensive ups and downs, the election recount efforts in Michigan, Wisconsin, and Pennsylvania have concluded. The main lesson: ballot audits should be less exciting and less expensive. Specifically, we need to make audits an ordinary, non-partisan part of every election, done efficiently and quickly, so they are not subject to emergency fundraising and last-minute debates over their legitimacy. The way to do that is clear: make risk-limiting audits part of standard election procedure.

After this year's election, EFFjoinedmany election security researchers in calling for a recount of votes in three key states. This was partly because of evidence that hackers affected other parts of the election (not directly related to voting machines). But more than that, it was based long-standing research showing that electronic voting machines and optical scanners are subject to errors and manipulation that could sway an election. In response to that call, Green Party candidate Jill Stein's campaign raised more than $7 million to fund the recounts.

The recount processes were, to say the least, disappointing. In Pennsylvania, the campaign's request for a recount was rejected by a federal judge. In Michigan, the recount started, but was halted a few days later. Only Wisconsin completed its recount, confirming the original vote result. However, many Wisconsin counties opted to simply run the ballots through their tabulating machine again. The obvious flaw with this technique is that if the tabulating machines were broken or compromised, the same inaccuracies they registered the first time around would show up the second time around, accomplishing nothing. However, based on the hand recounts performed in other Wisconsin counties, it's very unlikely that recounting those counties would have changed the overall result.

It's possible to achieve high confidence in a result and to be much more confident that the election is actually audited by only recounting some of the ballots. The technique is called a risk-limiting audit and it, roughly, works like this: you choose some percentage chance of spotting an incorrect result—say, 90% or 95%. Based on that chance, you can determine how many ballots to randomly sample for a hand recount. Close elections require you to sample more ballots than elections won by a large margin, and choosing a higher chance of spotting an incorrect result similarly means counting more ballots. There are a few other requirements. But in nearly all cases, a risk-limiting audit can be performed by hand-counting a much smaller number of ballots than a full recount. For instance, election security researcher Ron Rivest calculates that Michigan, if it had risk-limiting audits, could have counted just 11% of the ballots and achieved a 95% chance of spotting an incorrect result. Texas and Missouri, with their wider margins, could have counted 700 ballots and 10 ballots, respectively, to achieve the same confidence.

Fewer ballots mean less expense, like emergency recruitment of recount workers. It also means that auditing can become a routine part of every election. Regular auditing means that states and counties will become more skilled at performing the audits, which means they are more likely to spot problems, from mundane system errors to deliberate hacking. While risk-limiting audits are specific to elections, nearly any accounting process—from banking to corporate records to industrial accounting processes—requires a similar form of auditing. Indeed, the Nevada Gaming Commission has detailed audit requirements for everything from roulette to keno.

Voting reforms like this will not come about overnight, but all those concerned about the election integrity—whether based on foreign government interference, mistakes or otherwise—can work to make things better. Voting is largely controlled locally, so a concerted effort in your county or state is needed in order to build a national movement towards safer elections. Our friends at Verified Voting have long worked toward that end and they offer a summary of which states require what kinds of audits. Check the information for your state, and get in touch with your state and local election officials and legislators. Let them know you want two things: First, to phase out fully electronic voting machines (those that don't keep a paper trail) and, second, to audit and require risk-limiting audits for all elections. Audits are important even where all ballots are marked on paper by voters, because ballots are typically counted by optical scan machines, which are subject to manipulation in the same way that electronic voting machines are.

We have long believed that election systems should be treated with the same care and respect as other systems that are critical to national security. But by adopting risk-limiting audits, voters across the country can at least be assured that their vote is as secure as slot machines in Vegas.

Related Updates

The ability to vote for local, state, and federal representatives is the cornerstone of democracy in America. With mid-term congressional elections looming in early November, many voices have raised concerns that the voting infrastructure used by states across the Union might be suspect, unreliable, or potentially vulnerable to attacks. As...

Right now, the U.S. Senate is debating an issue that’s critical to our democratic future: secure elections. Hacking attacks were used to try to undermine the 2016 U.S. election, and in recent years, elections in Latin America and Ukraine were also subject to cyber attacks. It only makes sense to...

The Senate is working on a bill to secure election infrastructure against cybersecurity threats, but, unless amended, it will widely miss the mark. The current text of the Secure Elections Act1 omits the two most effective measures that could...

Election security experts concerned about voting machines are calling for an audit of ballots in the three states where the presidential election was very close: Michigan, Wisconsin and Pennsylvania. We agree. This is an important election safety measure and should happen in all elections, not just those that...

Most of the internet’s most popular voter registration sites make no promise to not turn and sell your information to advertisers, a Vocativ analysis has found. Of the nine major voter registration sites surveyed, only vote.gov, maintained by the U.S. General Services Administration, explicitly promises to neither...

“Honestly, the real answer is 'it depends.' Marking election systems as critical infrastructure might help us begin to make them more secure, but not necessarily. And federalizing election systems could make us less secure by creating fewer points of failure. But overall, [the Electronic Frontier Foundation] and our colleagues at...

A security flaw in New South Wales’ Internet voting system may have left as many as 66,000 votes vulnerable to interception and manipulation in a recent election, according to security researchers. Despite repeated assurances from the Electoral Commission that all Internet votes are “fully encrypted and safeguarded,” six...

Three years ago, I wrote of the controversy surrounding the use of Electronic Voting Machines (EVMs) in India. A study by 2010 EFF Pioneer Award winner Hari Prasad and others showed that the EVMs could be hacked. For his troubles, Prasad was charged criminally for alleged theft...

EFF and a coalition of voting integrity groups representing Sarasota County voters filed suit in state court in Tallahassee asking for a re-vote in Florida's 13th congressional district. The suit alleges that thousands of citizens were disenfranchised when massive under-votes plagued the tight congressional race between Democrat Christine Jennings and...